web-application-security-testing

# Web Application Security Testing ## Purpose Enable Claude to assist with comprehensive web application security assessments covering OWASP Top 10, injection testing, API security, authentication analysis, and client-side security. Claude analyzes application behavior, generates test payloads, reviews source code, and produces structured vulnerability reports. > **Authorization Required**: All testing must be performed on authorized targets only. Confirm scope and written authorization before testing. --- ## Activation Triggers This skill activates when the user asks about: - OWASP Top 10 testing or assessment methodology - SQL injection, XSS, SSRF, SSTI, command injection testing - API security testing (REST, GraphQL, SOAP) - Authentication bypass, session management flaws - Web application firewall (WAF) bypasses for authorized testing - CORS, CSP, or security header analysis - OAuth/OIDC security review - JWT analysis or manipulation - Burp Suite or OWASP ZAP usage guidance - Web vulnerability report writing --- ## Prerequisites ```bash pip install requests beautifulsoup4 urllib3 lxml ``` **Recommended tools:** - `Burp Suite Community/Pro` — Web proxy and scanner - `OWASP ZAP` — Open-source web scanner - `sqlmap` — Automated SQL injection (authorized use only) - `Nikto` — Web server scanner - `ffuf / feroxbuster` — Web fuzzer - `jwt_tool` — JWT analysis and manipulation --- ## Core Capabilities ### 1. OWASP Top 10 Assessment **When the user asks to assess fo...